ASB-A-504612754

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-504612754.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-504612754
Aliases
  • A-504612754
  • CVE-2026-49922
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T16:56:20Z
Summary
[none]
Details

In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/packages/services/Telecomm

Package

Name
platform/packages/services/Telecomm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-qpr2-next:0
Fixed
17-qpr2-next:2026-11-01

Affected versions

Other
17-qpr2-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/services/Telecomm/+/f93b1e37858cc84d29e9daa57fca0d5ff8fd718d"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "245119199649126703861091156142162242281",
                "length":  537
            },
            "id":  "ASB-A-504612754-95293d79",
            "match_only_versions":  [
                "17-qpr2-next"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/services/Telecomm/+/f93b1e37858cc84d29e9daa57fca0d5ff8fd718d",
            "target":  {
                "file":  "src/com/android/server/telecom/ConnectionServiceWrapper.java",
                "function":  "queryRemoteConnectionServices"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "116351678834445701071206380721420582045",
                    "302353530985646201335380535951438213695",
                    "336381818691306038010298984721682917413",
                    "161959456169685061143431771943308818010",
                    "101092358744341137725637525002484405961",
                    "278503811038784378973619098949731536652",
                    "55176005618510562308711840013890613482",
                    "241788340531073202913362132520032900514",
                    "68731918390243616678815821875892029651",
                    "68851936220059559151446500334615042661",
                    "260091009424696413441674874825254923617",
                    "72841479537362505861685449768186199528",
                    "113932742328212654938945691421138723194",
                    "284341452863539510134188980953020955233",
                    "322253896263715952330722050898299726309",
                    "181570424070791967675635095282325525041",
                    "300317465410289060595603556668785015337",
                    "26793227614976471429784599192076533669"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-504612754-caa3666c",
            "match_only_versions":  [
                "17-qpr2-next"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/services/Telecomm/+/f93b1e37858cc84d29e9daa57fca0d5ff8fd718d",
            "target":  {
                "file":  "src/com/android/server/telecom/ConnectionServiceWrapper.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-504612754.json"
platform/packages/services/Telecomm

Package

Name
platform/packages/services/Telecomm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-11-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/services/Telecomm/+/6557e81b57511166ac0b4352804f5316307dd2f2"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "245119199649126703861091156142162242281",
                "length":  537
            },
            "id":  "ASB-A-504612754-4600c31a",
            "match_only_versions":  [
                "15"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/services/Telecomm/+/6557e81b57511166ac0b4352804f5316307dd2f2",
            "target":  {
                "file":  "src/com/android/server/telecom/ConnectionServiceWrapper.java",
                "function":  "queryRemoteConnectionServices"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "116351678834445701071206380721420582045",
                    "302353530985646201335380535951438213695",
                    "336381818691306038010298984721682917413",
                    "161959456169685061143431771943308818010",
                    "101092358744341137725637525002484405961",
                    "278503811038784378973619098949731536652",
                    "55176005618510562308711840013890613482",
                    "241788340531073202913362132520032900514",
                    "68731918390243616678815821875892029651",
                    "68851936220059559151446500334615042661",
                    "260091009424696413441674874825254923617",
                    "72841479537362505861685449768186199528",
                    "113932742328212654938945691421138723194",
                    "284341452863539510134188980953020955233",
                    "322253896263715952330722050898299726309",
                    "181570424070791967675635095282325525041",
                    "300317465410289060595603556668785015337",
                    "26793227614976471429784599192076533669"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-504612754-b87e55b7",
            "match_only_versions":  [
                "15"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/services/Telecomm/+/6557e81b57511166ac0b4352804f5316307dd2f2",
            "target":  {
                "file":  "src/com/android/server/telecom/ConnectionServiceWrapper.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-504612754.json"
platform/packages/services/Telecomm

Package

Name
platform/packages/services/Telecomm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-11-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/services/Telecomm/+/260368fb70638d1f23fe1668264d6b8ffec2f1c1"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "116351678834445701071206380721420582045",
                    "302353530985646201335380535951438213695",
                    "336381818691306038010298984721682917413",
                    "161959456169685061143431771943308818010",
                    "101092358744341137725637525002484405961",
                    "278503811038784378973619098949731536652",
                    "55176005618510562308711840013890613482",
                    "241788340531073202913362132520032900514",
                    "68731918390243616678815821875892029651",
                    "68851936220059559151446500334615042661",
                    "260091009424696413441674874825254923617",
                    "72841479537362505861685449768186199528",
                    "113932742328212654938945691421138723194",
                    "284341452863539510134188980953020955233",
                    "322253896263715952330722050898299726309",
                    "181570424070791967675635095282325525041",
                    "300317465410289060595603556668785015337",
                    "26793227614976471429784599192076533669"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-504612754-62809b18",
            "match_only_versions":  [
                "16"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/services/Telecomm/+/260368fb70638d1f23fe1668264d6b8ffec2f1c1",
            "target":  {
                "file":  "src/com/android/server/telecom/ConnectionServiceWrapper.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "245119199649126703861091156142162242281",
                "length":  537
            },
            "id":  "ASB-A-504612754-ba9ccc85",
            "match_only_versions":  [
                "16"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/services/Telecomm/+/260368fb70638d1f23fe1668264d6b8ffec2f1c1",
            "target":  {
                "file":  "src/com/android/server/telecom/ConnectionServiceWrapper.java",
                "function":  "queryRemoteConnectionServices"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-504612754.json"
platform/packages/services/Telecomm

Package

Name
platform/packages/services/Telecomm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-11-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/services/Telecomm/+/c07db1c681bb9aa0dfbb0b0263c76a0597f1038f"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "116351678834445701071206380721420582045",
                    "302353530985646201335380535951438213695",
                    "336381818691306038010298984721682917413",
                    "161959456169685061143431771943308818010",
                    "101092358744341137725637525002484405961",
                    "278503811038784378973619098949731536652",
                    "55176005618510562308711840013890613482",
                    "241788340531073202913362132520032900514",
                    "68731918390243616678815821875892029651",
                    "68851936220059559151446500334615042661",
                    "260091009424696413441674874825254923617",
                    "72841479537362505861685449768186199528",
                    "113932742328212654938945691421138723194",
                    "284341452863539510134188980953020955233",
                    "322253896263715952330722050898299726309",
                    "181570424070791967675635095282325525041",
                    "300317465410289060595603556668785015337",
                    "26793227614976471429784599192076533669"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-504612754-037b234d",
            "match_only_versions":  [
                "16-qpr2"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/services/Telecomm/+/c07db1c681bb9aa0dfbb0b0263c76a0597f1038f",
            "target":  {
                "file":  "src/com/android/server/telecom/ConnectionServiceWrapper.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "245119199649126703861091156142162242281",
                "length":  537
            },
            "id":  "ASB-A-504612754-8868fefc",
            "match_only_versions":  [
                "16-qpr2"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/services/Telecomm/+/c07db1c681bb9aa0dfbb0b0263c76a0597f1038f",
            "target":  {
                "file":  "src/com/android/server/telecom/ConnectionServiceWrapper.java",
                "function":  "queryRemoteConnectionServices"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-504612754.json"
platform/packages/services/Telecomm

Package

Name
platform/packages/services/Telecomm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-11-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/services/Telecomm/+/9a75620f4384c2266389c4c06b899e7bae841589"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "116351678834445701071206380721420582045",
                    "302353530985646201335380535951438213695",
                    "336381818691306038010298984721682917413",
                    "161959456169685061143431771943308818010",
                    "101092358744341137725637525002484405961",
                    "278503811038784378973619098949731536652",
                    "55176005618510562308711840013890613482",
                    "241788340531073202913362132520032900514",
                    "68731918390243616678815821875892029651",
                    "68851936220059559151446500334615042661",
                    "260091009424696413441674874825254923617",
                    "72841479537362505861685449768186199528",
                    "113932742328212654938945691421138723194",
                    "284341452863539510134188980953020955233",
                    "322253896263715952330722050898299726309",
                    "181570424070791967675635095282325525041",
                    "300317465410289060595603556668785015337",
                    "26793227614976471429784599192076533669"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-504612754-a9870013",
            "match_only_versions":  [
                "14"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/services/Telecomm/+/9a75620f4384c2266389c4c06b899e7bae841589",
            "target":  {
                "file":  "src/com/android/server/telecom/ConnectionServiceWrapper.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "245119199649126703861091156142162242281",
                "length":  537
            },
            "id":  "ASB-A-504612754-b174db36",
            "match_only_versions":  [
                "14"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/services/Telecomm/+/9a75620f4384c2266389c4c06b899e7bae841589",
            "target":  {
                "file":  "src/com/android/server/telecom/ConnectionServiceWrapper.java",
                "function":  "queryRemoteConnectionServices"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-504612754.json"